searx: Ensure that socket is only reachable by Apache and root

When the security access restrictions are removed from /etc/security/access.d,
we don't want users to bypass Apache access control and directly access the app.

Tests:

- Without the patch, the uwsgi socket file is with permissions 666 in
/run/uwsgi/apps/searx/socket. nc -U <socket> succeeds as non-admin user on the
system.

- Apply the patch and restart FreedomBox. searx set is run and uwsgi service is
restarted and permissions are 660 on /run/uwsgi/apps/searx/socket. nc -U
<socket> fails as non-admin user on the system.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>

plinth/modules/searx/__init__.py

@@ -28,7 +28,7 @@ class SearxApp(app_module.App):
 
     app_id = 'searx'
 
-    _version = 4
+    _version = 5
 
     def __init__(self):
         """Create components for the app."""

plinth/modules/searx/privileged.py

@@ -44,6 +44,8 @@ def _update_uwsgi_configuration():
     aug.load()
     aug.set('/files/etc/uwsgi/apps-available/searx.ini/uwsgi/autoload',
             'false')
+    aug.set('/files/etc/uwsgi/apps-available/searx.ini/uwsgi/chmod-socket',
+            '660')
     aug.save()